An AI cracked the 25-year mystery of the NSA's elliptic-curve numbers in under half an hour: they were just 1997 timestamps, and bitcoin never used those curves anyway

One of cryptography's longest-running puzzles has an anticlimactic answer. Anthropic said on Thursday that its Claude model worked out where the mysterious seed values for the NIST elliptic curves came from: a standard C library random-number generator called lrand48, seeded with the computer's clock. The P-256 seed, for example, traces to August 16, 1997; the others fall between May 1997 and April 1998.

The curves were handed to the standards body NIST by the National Security Agency and published in 2000, but the agency never explained how the seeds were chosen. The NSA mathematician credited with them, Jerry Solinas, died in 2023, and the gap left room for a quarter-century of speculation that the constants might hide a weakness. A bounty organised by cryptographer Filippo Valsorda, now worth $36,864, went unclaimed until this week; Anthropic says the money will be donated to the Internet Security Research Group, the nonprofit behind Let's Encrypt.

Anthropic is careful about what the finding means. "This is not a cryptographic break, new attack, or weakness in the ECDSA curves," its write-up says, adding that the simple, reproducible method makes a deliberate backdoor less likely, not more. Some loose ends remain, including why a few valid candidate seeds were skipped and how several base points were chosen.

For crypto holders, the practical impact is nil. Bitcoin and Ethereum sign transactions with secp256k1, a curve with fewer adjustable parameters that was never part of the NIST mystery, CoinDesk noted. The story is a reminder that an AI model now does in 30 minutes what a bounty could not buy in three years.